Odaily Planet Daily reports: LayerZero Labs posted on X that on April 18, KelpDAO suffered an attack resulting in losses of approximately $290 million, with initial assessments pointing to Lazarus Group as the perpetrator. The attack was carried out by poisoning the downstream RPC infrastructure relied upon by KelpDAO’s decentralized verification network (DVN); the attackers compromised certain RPC nodes and coordinated a DDoS attack to force the system to switch to malicious nodes, thereby fabricating cross-chain transactions. The affected RPC nodes have since been taken offline and replaced, and the DVN has resumed operations.
LayerZero emphasized that this incident was limited to KelpDAO’s rsETH application configuration and did not affect any other assets or applications. KelpDAO was unable to detect forged messages due to its reliance on a single DVN architecture without multi-DVN redundancy. The LayerZero protocol itself had no vulnerabilities, and applications configured with multiple DVNs were unaffected. LayerZero will drive all single-DVN configurations to migrate to a multi-DVN architecture, has suspended signature and verification services for 1/1 configurations, and is assisting law enforcement in tracking the stolen funds.